| Establishing a Contingency Plan

HIPAA Security Rule § (a)(7) Contingency Plan The Contingency Plan standard requires covered entities to: “Establish (and implement as needed) policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, and natural disaster) that damages systems that contain ePHI.”

Agenda  Data Backup Plan  Disaster Recovery Plan  Emergency Mode Operation Plan  Testing and Revision Procedures  Applications and Data Criticality Analysis

 What ePHI must be backed up?  Have we included all data sources?  Have we considered various backup methods?  Is our backup data stored in a safe secure place? Data Backup Plan (Required) “Establish and Implement procedures to create and maintain retrievable exact copies of ePHI”

Sonya Christian, CIO; West Georgia Health

 You may already have a DR plan – does it address ePHI?  What specific threats do you face?  Does is address what data is to be restored?  Is the plan readily available – during an emergengy? Disaster Recovery Plan (Required) “Establish (and implement as needed) procedures to restore any loss of data.”

Emergency Mode Operation Plan (Required) Establish Procedures to Enable Continuation of Critical Business Processes to Protect the Security of ePHI While Operating In Emergency Mode

Emergency Mode Operation Plan Continuity of Operations Planning  Will determine the ability of your organization to continue its business operations  Improve the likelihood that your facility will survive and recover from events that impact business operations

Emergency Mode Operation Plan

Moving Towards Cloud Computing  Continuous Up-Time?  What is Downtime Costing Your Hospital?  Is Cloud Computing an Option?  What other risks does cloud computing invite?

 Have we documented our processes?  Does everyone understand their role?  Have we actually practiced and tested our procedures?  What did we learn?  How should we change our plan? Testing and Revision Procedures (Addressable) “Implement procedures for periodic testing and revision of contingency plans.”

Applications & Data Criticality Analysis

 Review critical computer and electronic systems  Identify applications critical to patient care

Questions and Discussion Don Kinser, PE, CPHIMS President and CEO EDI, ltd Mark Renfro Healthcare Consultant